Facets-cloud
diff --git a/‎.claude/settings.json‎
Lines changed: 27 additions & 0 deletions b/‎.claude/settings.json‎
Lines changed: 27 additions & 0 deletions
diff --git a/‎.gitignore‎
Lines changed: 5 additions & 2 deletions b/‎.gitignore‎
Lines changed: 5 additions & 2 deletions
diff --git a/‎README.md‎
Lines changed: 57 additions & 0 deletions b/‎README.md‎
Lines changed: 57 additions & 0 deletions
diff --git a/‎cmd/mcp.go‎
Lines changed: 5 additions & 1 deletion b/‎cmd/mcp.go‎
Lines changed: 5 additions & 1 deletion
diff --git a/‎cmd/mcp_test.go‎
Lines changed: 58 additions & 0 deletions b/‎cmd/mcp_test.go‎
Lines changed: 58 additions & 0 deletions
@@ -0,0 +1,27 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "_comment": "Project-level Claude Code settings for praxis-cli. The deny list below prevents Claude from reading credential / secret files into the conversation transcript. See SKILL.md 'Credential safety' rule and the praxis-onboarding QA findings for context.",
+  "permissions": {
+    "deny": [
+      "Read(~/.aws/**)",
+      "Read(~/.praxis/credentials)",
+      "Read(~/.praxis/credentials.*)",
+      "Read(~/.facets/**)",
+      "Read(~/.config/gcloud/**)",
+      "Read(~/.azure/**)",
+      "Read(**/*.pem)",
+      "Read(**/*.key)",
+      "Read(**/*.p12)",
+      "Read(**/id_rsa)",
+      "Read(**/id_rsa.*)",
+      "Read(**/id_ed25519)",
+      "Read(**/id_ed25519.*)",
+      "Read(**/*.token)",
+      "Bash(cat ~/.aws/*)",
+      "Bash(cat ~/.praxis/credentials*)",
+      "Bash(cat ~/.facets/*)",
+      "Bash(cat ~/.config/gcloud/*)",
+      "Bash(cat ~/.azure/*)"
+    ]
+  }
+}
@@ -31,8 +31,11 @@ coverage.txt
 .env
 .env.local
 
-# Claude Code state — agent transcripts, plans, worktrees
-/.claude/
+# Claude Code state — agent transcripts, plans, worktrees.
+# DO commit project-level settings.json (defines deny rules for
+# credential files — see .claude/settings.json comment).
+/.claude/*
+!/.claude/settings.json
 
 # codegraph index
 /.codegraph/
@@ -279,6 +279,63 @@ praxis logout --all
 ~/.gemini/skills/...                  same shape for Gemini CLI
 ```
 
+## Security — credential-file deny rules
+
+This repo ships a project-level `.claude/settings.json` that **denies
+Claude Code from reading credential / secret files** into the
+conversation transcript. The deny list covers `~/.praxis/credentials`
+plus the whole of `~/.aws/`, `~/.facets/`, `~/.config/gcloud/`,
+`~/.azure/`, and common key file patterns (`*.pem`, `*.key`, `id_rsa*`,
+`id_ed25519*`, `*.token`). The rest of `~/.praxis/` stays readable on
+purpose — the praxis skill greps `~/.praxis/mcp-tools.json`.
+Project-level settings apply to anyone working inside this repo.
+
+**Recommended for all users:** adopt the same deny rules globally in
+`~/.claude/settings.json` so they apply to *every* Claude Code session
+on your machine, not just sessions opened inside praxis-cli.
+
+If `~/.claude/settings.json` **does not exist yet**, copy the entire
+[`.claude/settings.json`](.claude/settings.json) from this repo as a
+starting point:
+
+```bash
+mkdir -p ~/.claude
+cp .claude/settings.json ~/.claude/settings.json
+```
+
+If you **already have** a `~/.claude/settings.json` with other
+permissions or settings, merge in the `permissions.deny` entries
+from this repo's file — don't replace your whole settings object.
+Append entries to your existing `permissions.deny` array (deduping
+any already present), preserving everything else.
+
+Why this matters: the praxis CLI stores PAT tokens in
+`~/.praxis/credentials`. The conversation transcript is persisted to
+`~/.claude/projects/<encoded-project>/<session-uuid>.jsonl` and may
+be synced, shared, or pasted. A `Read` or `cat` of a credentials
+file would dump tokens into that transcript — a new exposure surface
+beyond the file itself. The deny rules prevent the tool call before
+it executes.
+
+**If you find a token in a transcript:**
+
+1. **Rotate the affected PAT immediately** via the Facets UI
+   (Users → API tokens → revoke + regenerate).
+2. **Clean the transcript.** Transcript files live at
+   `~/.claude/projects/<encoded-project>/<session-uuid>.jsonl` (one
+   JSONL file per session). Find the affected file:
+   ```bash
+   grep -rl '<the-leaked-token-prefix>' ~/.claude/projects/
+   ```
+   Then either **delete the whole session file** (simplest; loses
+   conversation history) or **scrub the specific lines** containing
+   the token while preserving the rest. For a quick redact:
+   ```bash
+   sed -i.bak 's/<token-value>/REDACTED/g' <the-file>
+   ```
+   After scrubbing, verify each line of the JSONL is still valid
+   JSON (`python3 -c 'import sys,json; [json.loads(l) for l in sys.stdin]' < <the-file>`).
+
 ## Why a CLI
 
 CLIs run anywhere: any AI host, CI, cron, shell pipelines. MCP
 
@@ -27,7 +27,11 @@ var (
 
 func init() {
 	mcpCmd.Flags().BoolVar(&mcpJSON, "json", false, "JSON output (default when stdout is non-TTY)")
-	mcpCmd.Flags().StringSliceVar(&mcpArgs, "arg", nil, "key=value pair (repeatable); merged into request body")
+	// Use StringArrayVar (not StringSliceVar) so each --arg value is taken as a
+	// literal string with no CSV-style splitting. StringSlice trips on embedded
+	// commas and double quotes in the value — see TestMcpArgFlag_* regression
+	// tests covering raptor commands like `--arg command='... "quoted" ...'`.
+	mcpCmd.Flags().StringArrayVar(&mcpArgs, "arg", nil, "key=value pair (repeatable); merged into request body")
 	mcpCmd.Flags().StringVar(&mcpBody, "body", "", "raw JSON body (use '-' for stdin); overrides --arg")
 	mcpCmd.Flags().DurationVar(&mcpTimeout, "timeout", 60*time.Second, "request timeout")
 	rootCmd.AddCommand(mcpCmd)
 
@@ -92,6 +92,64 @@ func TestBuildMCPBody_BodyNotObject_Rejected(t *testing.T) {
 	}
 }
 
+// Regression tests for B7 — `--arg` value parsing.
+//
+// The bug: pflag's StringSlice does CSV-style parsing on each --arg value,
+// which trips on embedded double quotes (`bare " in non-quoted-field`) and
+// also splits on commas inside a single value. Real-world callers pass
+// raptor commands like `--arg command='create project foo --description
+// "Bar"'` — those quotes / commas must reach buildMCPBody intact.
+//
+// Fix: bind --arg with StringArrayVar (literal per-flag value, no CSV
+// splitting). The table cases below ParseFlags on mcpCmd and assert the
+// literal value comes through.
+
+func TestMcpArgFlag_LiteralValueParsing(t *testing.T) {
+	tests := []struct {
+		name     string
+		flagArgs []string
+		want     []string
+	}{
+		{
+			name:     "embedded quotes preserved",
+			flagArgs: []string{"--arg", `command=create project praxis-hello --description "Onboarding sample project"`},
+			want:     []string{`command=create project praxis-hello --description "Onboarding sample project"`},
+		},
+		{
+			name:     "embedded commas preserved (no CSV splitting)",
+			flagArgs: []string{"--arg", `tags=a,b,c`},
+			want:     []string{`tags=a,b,c`},
+		},
+		{
+			name: "repeated flags produce multiple entries",
+			flagArgs: []string{
+				"--arg", `command=foo "bar"`,
+				"--arg", `integration_name=aws-prod`,
+			},
+			want: []string{`command=foo "bar"`, `integration_name=aws-prod`},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resetMcpFlags()
+			defer resetMcpFlags()
+
+			if err := mcpCmd.ParseFlags(tt.flagArgs); err != nil {
+				t.Fatalf("ParseFlags() error = %v", err)
+			}
+			if len(mcpArgs) != len(tt.want) {
+				t.Fatalf("got %d args, want %d: %q", len(mcpArgs), len(tt.want), mcpArgs)
+			}
+			for i, want := range tt.want {
+				if mcpArgs[i] != want {
+					t.Errorf("arg[%d] = %q, want %q", i, mcpArgs[i], want)
+				}
+			}
+		})
+	}
+}
+
 func TestExtractDetail(t *testing.T) {
 	got := extractDetail([]byte(`{"detail":"missing key"}`), "fallback")
 	if got != "missing key" {